Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

image.png

hey all! I am attempting to split out the web interface and agent checkin via nginx.

here is my nginx config: <https://gist.github.com/defensivedepth/3c1cb25315090757aed03e9d5a5e9b06>

Everything is working except for live queries. I can login to the Web interface via https//FleetHostname:9443. Orbit endpoints are showing refreshed data &amp; scheduled query results are coming in fine. Just not live queries - when I run a live query, never ever shows up (see screenshot).

In the nginx logs I see successful POST requests:

```192.168.x.x - - [09/Apr/2024:13:18:08 +0000] "POST /api/v1/osquery/distributed/read HTTP/1.1" 200 147 "-" "osquery/5.11.0"
192.168.x.x - - [09/Apr/2024:13:18:08 +0000] "POST /api/v1/osquery/distributed/write HTTP/1.1" 200 3 "-" "osquery/5.11.0"```

No errors in any other logs that I can see.

Any thoughts?

ah, looks like the websocket connection is failing for some reason.

Is the origin changing? <https://fleetdm.com/docs/configuration/fleet-server-configuration#server-websockets-allow-unsafe-origin|https://fleetdm.com/docs/configuration/fleet-server-configuration#server-websockets-allow-unsafe-origin> I’ve seen this before when proxying websockets. 

Thats was it! Thanks <@U028H7VT5P0>! I don't recall that config option in previous versions.